CVE-2026-31979: Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Prior to 3.1.0 and 2.3.8, the himmelblaud-tasks daemon, running as root…

PriorityP344high7.8CVSS 3.1

AVLACLPRLUINSUCHIHAH

EPSS

0.20%

9.5th percentile

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Prior to 3.1.0 and 2.3.8, the himmelblaud-tasks daemon, running as root, writes Kerberos cache files under /tmp/krb5cc_ without symlink protections. Since commit 87a51ee, PrivateTmp is explicitly removed from the tasks daemon's systemd hardening, exposing it to the host /tmp. A local user can exploit this via symlink attacks to chown or overwrite arbitrary files, achieving local privilege escalation. This vulnerability is fixed in 3.1.0 and 2.3.8.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
himmelblau-idm	himmelblau	—	—
himmelblau-idm	himmelblau	—	—
himmelblau-idm	himmelblau	>= 1.0.0 < 2.3.8	2.3.8
himmelblau-idm	himmelblau	>= 3.0.0 < 3.1.0	3.1.0

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.